Modern enterprise computing systems often rely on multiple applications that collaborate and/or interact with each other (often through the use of services). In some cases, this interaction serves the goal of performing a requested operation (and/or set of operations) in response to a user request. For instance, if a user requests an operation or service from one application, that application, as part of responding to the user request might need to interact with a service provided by another application.
Merely by way of example, in Oracle Corp.'s Oracle Collaboration Services™ (“OCS”), various components (including without limitation, email, calendar, file sharing, web conferencing, etc.) often will invoke one another in response to user request. When scheduling a meeting in the calendar component, for instance, a user might be given the option to set of a web conference for that meeting. A variety of other applications interact similarly, including for example, customer relations management software, enterprise resource planning software, various office applications, and the like.
In many cases, such inter-application interactions require that one application proxy for the user in requesting services from another application. In existing systems, a called service typically either will maintain its own local security policy and/or will trust the calling application implicitly. Hence, in many cases, these service-to-service requests can lead to manageability issues.
For example, in the typical environment, each application will implement its own policy mechanism to deal with security issues in a service-to-service context, requiring configuration and/or management of multiple, often disparate security models throughout the enterprise. Further, without a uniform security framework, these service-to-service interactions created additional security issues. Merely by way of example, in some cases, a particular service, when called by another service, might rely on the calling service to perform user authentication and/or authorization, while the calling service might not be configured to require user authentication and/or authorization, leading to a security vulnerability.